Activity timeline
T1456 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 4 reports, and 12 of the 12 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1456 Drive-By Compromise is catalogued by MITRE ATT&CK under the Initial Access (Mobile) tactic in the Mobile matrix. Threadlinqs maps 12 of 2623 tracked threats (0.5%) to it; by severity that is 2 critical, 9 high.
Threats that use T1456 most often also use T1426 System Information Discovery (9 threats), T1430 Location Tracking (9 threats), T1646 Exfiltration Over C2 Channel (9 threats), T1409 Stored Application Data (8 threats), T1417 Input Capture (8 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
2 tracked threat actors appear in the threats that use T1456; the most frequent are NSO Group (3), Intellexa Consortium (1).
Mitigations
MITRE ATT&CK lists 1 mitigation for T1456.
Threat actors using it
Tracked threats
12 tracked threats use T1456.
- Pegasus Spyware Used to Hack Phone of Former MEP Stelios Kouloglou, PEGA Committee Memberhigh
- Serbian Authorities Deploy Pegasus and NoviSpy Spyware Against Journalists, Opposition Politicians, and…high
- StreamRat Android Banking Trojan Spreads via Fake Streaming-Service Ads on Meta and TikTokhigh
- Apple Expands On-Device Lock Screen Alerts for Mercenary Spyware Targetshigh
- NSO Group Co-Founder Shalev Hulio Held Israeli Diplomatic Passport in Panama, Raising State-Ties Questions…
- "BH Alert" Fake Bahrain Civil Defense App Deploys Four-Stage OctagonPanel Android Surveillance Platformhigh
- Pegasus Spyware Used Against Former MEP Stelios Kouloglou While Serving on PEGA Committeecritical
- European Parliament Member Investigating Pegasus Spyware Hacked With Pegasus (PWNYOURHOME Zero-Click Exploit…critical
- Rokarolla Android Banking Trojan Targets 217 Banking and Cryptocurrency Apps with 137 Remote Commandshigh
- Pegasus Mercenary Spyware Used for State Surveillance of Azerbaijani Journalists, Activists, and Human…high
- NSO Group Pegasus Spyware — WhatsApp Spearphishing Campaign Alleged in Meta Contempt Complaint (June 2026)high
- BTMOB Android RAT — SpySolr Evolution Sold as MaaS via Telegram with APK Builder and Accessibility Services…high
Detection coverage
Threadlinqs maintains 20 detection rules mapped to T1456 (SPL 9, KQL 5, Sigma 6). Rule content is available to Blue tier accounts and above; this page shows counts only.